fix(e2e): secure pulumi host passwords

Author: quentinus95

test/e2e-framework/resources/azure/compute/vm.go

@@ -66,10 +66,10 @@ func NewWindowsInstance(e azure.Environment, name, imageUrn, instanceType string
 	pwdOpts := make([]pulumi.ResourceOption, 0, len(opts)+1)
 	copy(pwdOpts, opts)
 	pwdOpts = append(pwdOpts, e.WithProviders(config.ProviderRandom))
-	windowsAdminPassword, err := random.NewRandomString(e.Ctx(), e.Namer.ResourceName(name, "admin-password"), &random.RandomStringArgs{
+	windowsAdminPassword, err := random.NewRandomPassword(e.Ctx(), e.Namer.ResourceName(name, "admin-password"), &random.RandomPasswordArgs{
 		Length:  pulumi.Int(20),
 		Special: pulumi.Bool(true),
-		// Disallow "<", ">" and "&" as they get encoded by json.Marshall in the CI log output, making the password hard to read
+		// Avoid characters that are awkward in generated PowerShell and Pulumi JSON.
 		OverrideSpecial: pulumi.String("!@#$%*()-_=+[]{}:?"),
 	}, pwdOpts...)
 	if err != nil {
@@ -132,7 +132,7 @@ func NewWindowsInstance(e azure.Environment, name, imageUrn, instanceType string
 		return args[0].(string)
 	}).(pulumi.StringOutput)
 
-	return vm, privateIP, windowsAdminPassword.Result, nil
+	return vm, privateIP, pulumi.ToSecret(windowsAdminPassword.Result).(pulumi.StringOutput), nil
 }
 
 func newVMInstance(e azure.Environment, name, imageUrn, instanceType string, enableAcceleratedNetworking bool, osProfile compute.OSProfilePtrInput, opts ...pulumi.ResourceOption) (*compute.VirtualMachine, *network.NetworkInterface, error) {

test/e2e-framework/scenarios/aws/ec2/vm.go

@@ -108,10 +108,10 @@ func NewVM(e aws.Environment, name string, params ...VMOption) (*remote.Host, er
 			// 		* Base 10 digits (0 through 9).
 			// 		* Non-alphanumeric characters (special characters): '-!"#$%&()*,./:;?@[]^_`{|}~+<=>
 			// Source: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements
-			randomPassword, err := random.NewRandomString(e.Ctx(), e.Namer.ResourceName(name, "win-admin-password"), &random.RandomStringArgs{
+			randomPassword, err := random.NewRandomPassword(e.Ctx(), e.Namer.ResourceName(name, "win-admin-password"), &random.RandomPasswordArgs{
 				Length:  pulumi.Int(20),
 				Special: pulumi.Bool(true),
-				// Disallow "<", ">" and "&" as they get encoded by json.Marshall in the CI log output, making the password hard to read
+				// Avoid characters that are awkward in the generated PowerShell command and Pulumi JSON.
 				OverrideSpecial: pulumi.String("!@#$%*()-_=+[]{}:?"),
 				MinLower:        pulumi.Int(1),
 				MinUpper:        pulumi.Int(1),
@@ -129,7 +129,7 @@ func NewVM(e aws.Environment, name string, params ...VMOption) (*remote.Host, er
 				return err
 			}
 
-			c.Password = randomPassword.Result
+			c.Password = pulumi.ToSecret(randomPassword.Result).(pulumi.StringOutput)
 		}
 
 		return nil

test/e2e-framework/testing/provisioners/BUILD.bazel

@@ -1,4 +1,4 @@
-load("@rules_go//go:def.bzl", "go_library")
+load("@rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
     name = "provisioners",
@@ -15,3 +15,10 @@ go_library(
         "@com_github_pulumi_pulumi_sdk_v3//go/pulumi",
     ],
 )
+
+go_test(
+    name = "provisioners_test",
+    srcs = ["pulumi_provisioner_test.go"],
+    embed = [":provisioners"],
+    gotags = ["test"],
+)

test/e2e-framework/testing/provisioners/pulumi_provisioner.go

@@ -6,6 +6,7 @@
 package provisioners
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -113,11 +114,56 @@ func (pp *PulumiProvisioner[Env]) ProvisionEnv(ctx context.Context, stackName st
 func dumpRawResources(resources RawResources) string {
 	var builder strings.Builder
 	for key, value := range resources {
-		fmt.Fprintf(&builder, "%s: %s\n", key, value)
+		fmt.Fprintf(&builder, "%s: %s\n", key, redactRawResource(value))
 	}
 	return builder.String()
 }
 
+func redactRawResource(rawResource []byte) []byte {
+	var resource any
+	if err := json.Unmarshal(rawResource, &resource); err != nil {
+		return []byte("<invalid resource output>")
+	}
+
+	redactedResource := redactSensitiveFields(resource)
+	var buffer bytes.Buffer
+	encoder := json.NewEncoder(&buffer)
+	encoder.SetEscapeHTML(false)
+	encoder.SetIndent("", "\t")
+	if err := encoder.Encode(redactedResource); err != nil {
+		return []byte("<invalid resource output>")
+	}
+
+	return bytes.TrimSuffix(buffer.Bytes(), []byte("\n"))
+}
+
+func redactSensitiveFields(value any) any {
+	switch typedValue := value.(type) {
+	case map[string]any:
+		redacted := make(map[string]any, len(typedValue))
+		for key, nestedValue := range typedValue {
+			if isSensitiveField(key) {
+				redacted[key] = "<redacted>"
+				continue
+			}
+			redacted[key] = redactSensitiveFields(nestedValue)
+		}
+		return redacted
+	case []any:
+		redacted := make([]any, len(typedValue))
+		for index, nestedValue := range typedValue {
+			redacted[index] = redactSensitiveFields(nestedValue)
+		}
+		return redacted
+	default:
+		return value
+	}
+}
+
+func isSensitiveField(key string) bool {
+	return strings.Contains(strings.ToLower(key), "password")
+}
+
 // Diagnose runs the diagnose function if it is set diagnoseFunc
 func (pp *PulumiProvisioner[Env]) Diagnose(ctx context.Context, stackName string) (string, error) {
 	if pp.diagnoseFunc != nil {

test/e2e-framework/testing/provisioners/pulumi_provisioner_test.go

@@ -0,0 +1,45 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2016-present Datadog, Inc.
+
+package provisioners
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestDumpRawResourcesRedactsPasswords(t *testing.T) {
+	resources := RawResources{
+		"dd-Host-aws-vm": []byte(`{
+			"address": "10.0.0.1",
+			"password": "top-secret-password",
+			"nested": {
+				"adminPassword": "nested-secret-password",
+				"username": "Administrator"
+			}
+		}`),
+	}
+
+	output := dumpRawResources(resources)
+
+	for _, secret := range []string{"top-secret-password", "nested-secret-password"} {
+		if strings.Contains(output, secret) {
+			t.Fatalf("dumpRawResources leaked secret %q in output:\n%s", secret, output)
+		}
+	}
+	for _, expected := range []string{
+		`"password": "<redacted>"`,
+		`"adminPassword": "<redacted>"`,
+		`"username": "Administrator"`,
+	} {
+		if !strings.Contains(output, expected) {
+			t.Fatalf("dumpRawResources output does not contain %q:\n%s", expected, output)
+		}
+	}
+
+	if !strings.Contains(string(resources["dd-Host-aws-vm"]), "top-secret-password") {
+		t.Fatal("dumpRawResources modified the raw resources used for environment imports")
+	}
+}